gnustep-dev
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Registry problems on Win32 with NSMessagePortNameServerWin32


From: Wim Oudshoorn
Subject: Registry problems on Win32 with NSMessagePortNameServerWin32
Date: Tue, 23 Jan 2007 12:04:23 +0100
User-agent: Gnus/5.1002 (Gnus v5.10.2) Emacs/22.0.50 (darwin)

We have occasional problems using DO on windows.  
Now we have tracked down at least one of the reasons and it is 
in the file win32/NSMessagePortNameServerWin32.m

There are two strange things:


1 - A bug
---------

In the method  -registerPort:forName:
there is a call to RegSWetValueExW that looks like:

      rc = RegSetValueExW (
            key,
            UNISTR (n)
            0,
            REG_BINARY,
            [[(NSMessagePort*) port name] UTF8String],
            25);            

Now the 25 is of course wrong.  It points to the length of the byte
array that is the result of the UTF8String call in the line above it.
So if the string is less than 25 bytes (including the 0 byte) it
will read from undefined memory, which will lead to an occasional crash :-(.



2 - Other (potential) bug
-------------------------

This is where I assume the value written above is read.
It is in the method: +_query:

The offending code in question is:
             
       unsigned char buf[25];
       DWORD         len = 25;
 
       // skipped code

       rc = RegQueryValueExW (
             key,
             UNISTR (n),
             (LPDWORD) 0,
             &type,
             (LPBYTE) buf,
             &len);

       n = [NSString stringWithUTF8String: buf];       
       p = [NSString stringWithFormat: @".....", n];
       h = CreateFileW ( with lots of paremeters);
       if (h == INVALID_HANDLE_VALUE)
         {
           RegDeleteValueW (key, UNISTR(n));
           

Well there seem to be two obvious problems with this code:
    1 - If the retun value in buf is not zero terminated 
        the n = [NSString ...]  will read beyond the buffer.
    2 - If h == INVALID_HANLE_VALUE the idea is to remove
        the entry from the registry.  But the variable n 
        is not the same anymore as the one used in the query.
        So I think the removal does not work.

Also the "weird hack" comment is, well, let me put it this way, 
I would be happier if the weird hack was not needed.

Wim Oudshoorn.

P.S.:  I am a little busy right now, so don't expect a fix 
very soon.  But eventually I will come around to it.

And oh, it is quite annoying, it quite regularly happens
that the first try of starting our application fails,
perhaps due to this.

             




reply via email to

[Prev in Thread] Current Thread [Next in Thread]